CVE-2023-50020 is a high severity (CVSS 7.5) denial of service in Open5GS 2.6.6, where a SIGPIPE signal can crash the AMF. The fix was merged into the main code on 28 November 2023. The project issue names no release, so update to a build that includes that commit.
What's affected
The record names Open5GS 2.6.6. The weakness is CWE-400 (uncontrolled resource consumption). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H: network reachable, no login, high availability impact only.
The GitHub issue number 2734 shows a commit titled as a fix for a crash on SIGPIPE in the SCTP code, first applied on a branch on 26 November 2023, where the reporter confirmed it resolved the crash. It was merged into the main code on 28 November 2023 through pull request 2757.
Fixed versions: the issue does not name a release tag. Check the Open5GS release notes published after 28 November 2023 and confirm the commit is in the version you install.
How to check if you're exposed
Find the Open5GS version on each core network host.
open5gs-amfd -v
If you build from source, check that your tree includes the SCTP fix commit from late November 2023.
git log --oneline | grep -i sigpipe
Core network functions should not face the internet, so also check which networks can reach the AMF's SCTP port. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Inventory Open5GS deployments, including test and lab cores.
- Update to a release or build that includes the November 2023 fix.
- Restrict network access to the AMF's control interfaces to your radio network and trusted management hosts.
- Run the AMF under a process supervisor, so a crash restarts it quickly, and alert on repeated restarts.
- Review logs for crashes from earlier runs, which may mean someone triggered the fault.
Why it matters
A process that receives SIGPIPE without handling it is terminated by default. When a peer closes a network connection and the process then writes to it, the signal arrives. If the process does not ignore or handle it, one closed connection can bring down a core network function.
The AMF is the entry point for devices into a 5G core, so its availability matters for every connected subscriber. The impact is availability only. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which release contains the fix?
The issue names none. The fix was merged on 28 November 2023, so use a release or build that postdates it and verify.
Does it affect confidentiality?
No. The vector shows high availability impact only.
Sources
Last reviewed: 19 October 2026.
